CVE-2026-8709

Analyzed Analyzed - Analysis Complete

Improper Privilege Escalation in MarkLogic Server REST API

Publication date: 2026-08-05

Last updated on: 2026-09-03

Assigner: Progress Software Corporation

Description

An improper privilege management vulnerability in the REST API document patch operation of Progress MarkLogic Server before 11.3.6 and 12.0.3 allows an authenticated user with a low-privileged REST role to escalate privileges and execute privileged operations against the Security database.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-05

Last Modified

2026-09-03

Generated

2026-09-14

AI Q&A

2026-08-05

EPSS Evaluated

2026-09-13

NVD

CVE-2026-8709

EUVD

EUVD-2026-53425

Affected Vendors & Products

Vendor	Product	Version / Range
progress	marklogic_server	to 11.3.6 (exc)
progress	marklogic_server	From 12.0.0 (inc) to 12.0.3 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-269	The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

Attack-Flow Graph

Executive Summary

This vulnerability is an improper privilege management issue in the REST API document patch operation of Progress MarkLogic Server versions before 11.3.6 and 12.0.3. It allows an authenticated user with a low-privileged REST role to escalate their privileges and perform privileged operations against the Security database.

Detection Guidance

To detect this vulnerability, check the version of Progress MarkLogic Server running on your system. Compare it against versions 11.3.6, 12.0.3, or later. If your version is earlier, the system is vulnerable. Use commands like 'curl -X GET http://<server>:<port>/v1/rest-api' to inspect API endpoints and verify patch levels.

Impact Analysis

An attacker could exploit this to gain elevated access, potentially allowing them to read, modify, or delete sensitive data in the Security database. This could lead to unauthorized data access, data breaches, or system compromise.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating compliance requirements for GDPR, HIPAA, and other regulations. It may result in data breaches, legal penalties, and reputational damage.

Mitigation Strategies

Upgrade Progress MarkLogic Server to version 11.3.6, 12.0.3, or later to address the improper privilege management vulnerability in the REST API document patch operation.

Hi! I’m here to help you understand CVE-2026-8709. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70